[Snort-users] Smb output

Frank Knobbe frank at ...9761...
Wed Jul 21 13:44:09 EDT 2004


On Wed, 2004-07-21 at 01:22, Nerijus Krukauskas wrote:
>    Smb alerting would be soooo sloooow, that snort would start 
> dropping packets very soon and very fast.

Is that really the case? Isn't the SMB alert just a single UDP packet?
If so, it would be comparable to a TCP reset packet. Does that slow
Snort down that much? Perhaps the SMB plugin just needs to be optimized
properly...

Regards,
Frank

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20040721/2639b77e/attachment.sig>


More information about the Snort-users mailing list